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Abstract — We study quantum communication in the presence 
of adversarial noise. In this setting, communicating with perfect 
fidelity requires a quantum code of bounded minimum distance, 
for which the best known rates are given by the quantum 
Gilbert- Varshamov (QGV) bound. Asking only for arbitrarily 
high fidelity and letting the sender and reciever use a secret 
key of length logarithmic in the number of qubits sent, we find a 
dramatic improvement over the QGV rates. In fact, our protocols 
allow high fidelity transmission at noise levels for which perfect 
fidelity is impossible. To achieve such rates, we introduce fully 
quantum list codes, which may be of independent interest. 

Index Terms — Quantum error correction, adversarial chan- 
nels, approximate quantum codes, quantum list codes. 



I. Introduction 

Effectively dealing with noise is a major challenge faced 
by all proposals for the coherent manipulation of quantum 
information. Besides communication, sending a quantum state 
over a noisy channel models noisy storage, and as such, 
characterizing communication rates for quantum channels is 
a central question in the study of both quantum information 
and computation. 

Various asymptotic capacities of quantum channels have been 
studied [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11]. 
However, this work has been almost exclusively concerned 
with discrete memoryless channels (DMCs), wherein a sender 
and receiver use many independent and identical copies of a 
channel. In this scenario, one studies the asymptotic commu- 
nication rate possible using an operation of the form A/"®", 
where AT is the channel under consideration and the rate is 
R = k/n where k is the number of high fidelity logical qubits 
sent. Relatively little is known outside of the DMC scenario, 
with notable exceptions found in [12], [13], [14], [15], [16]. 

In this paper, we study an adversarial quantum channel (AQC), 
which is perhaps as different from a DMC as one can imagine. 
When sending n qubits over an AQC, instead of errors on dif- 
ferent qubits occuring independently, an adversary who knows 
what protocol is being used tries to foil the communication by 
maliciously choosing a superposition of errors, subject only to 
a restriction on the number of qubits each error affects. We 
call this channel Af^ , where p is the fraction of qubits the 
adversary is allowed to corrupt. Af^ is the natural quantum 
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generalization of the classical adversarial channel that was 
considered in [17], [18] and whose roots go back to [19]. 

If the receiver must reconstruct the logical state exactly, 
communicating over Af? „ requires a quantum error correcting 
code (QECC) of distance 2\np] + 1. The quantum Gilbert - 
Varshamov bound guarantees the existence of such a code with 
a rate of at least 1— H(2p)— 2plog3 [20], where logarithms are 
taken base 2 here and throughout. Communication beyond this 
rate is possible only if QECCs beating the Gilbert- Varshamov 
bound exist, which is a question that has been quite difficult 
to resolve. Furthermore, Rains has shown [21], [22] that no 
quantum code can have distance greater than n (3 — V3) /4 m 
0.317n, so that it is impossible to send even a single qubit for 
P > (3- V3)/8 w 0.158. 

However, if we ask only for a high fidelity reconstruction, 
and allow the sender and receiver to share a secret key of 
size O(logn) it is possible to communicate at rates much 
higher than the Gilbert- Varshamov and Rains bounds suggest. 
Below, we present a coding strategy for this scenario with a 
rate of 1— H(p)~ plog3, which is significantly larger than the 
Gilbert- Varshamov rate for all values of p and remains nonzero 
up to p w 0.189. Our rate equals the best communication rate 
via the depolarizing channel (in the DMCs scenario) of error 
probability p using only nondegenerate codes. 

There are three ingredients in achieving such rates with 
negligible length secret keys. The first is a predetermined 
quantum list code that is known to the adversary. This alone 
allows high-rate but low-fidelity transmission. To improve the 
fidelity, a random subcode is further chosen according to a 
secret key unknown to the adversary. Finally, the subcode is 
derandomized using small-biased sets. 

Before explaining the construction of our code, we first discuss 
some intuition on why the code works and how resources are 
being reduced. Informally, a quantum list code is an error 
correcting code with the relaxed reconstruction requirement 
that the decoded state be equal to the original state acted 
on by a superposition of a small number of errors. We 
call the number of errors the "list length." This relaxation 
allows a considerable increase in rate over QECCs, and by 
a random coding argument we show there are list codes with 
constant-length lists and rates approaching 1— H(p)— plog3 
that tolerate pn errors. To distinguish between the errors in 
the list and communicate with high fidelity, the sender and 
receiver select a large subcode of the list code using a secret 
key. In particular, this can be chosen pseudorandomly by using 
0(log n) bits of secret key. 
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We can interpret our code as a set of (parity) check conditions 
that yield syndrome information. Most of these conditions are 
used in list-decoding and can be known to the adversary, 
and the rest of the conditions are pseudorandom and with 
high probability are capable of completely distinguishing the 
errors on the list. Note that there are simpler constructions 
using randomness unknown to the adversary, and we now 
make a comparison. The first construction is simply a random 
(nondegenerate) quantum error correcting code achieving the 
same rate but requiring 0(n 2 ) bits of secret key Q. Second, 
one could use a secret permutation of the n qubits in the AQC 
turning the adversarial channel to something very similar to 
n depolarizing DMCs of error p in the DMCs setting [24], 
[15]. The best known rate is similar to ours (but slightly 
better for large p) but the cost will be O(nlogn) bits of key, 
which, unfortunately, still gives a divergent key rate. Third, 
the standard derandomizing technique of key recycling cannot 
be used in a straightforward way in the current, adversarial, 
context. Thus, our hybrid construction involving a known list- 
code and a pseudorandom subcode demonstrates what type 
of randomness is unnecessary, and can be seen as a method 
to derandomize other key-inefficient protocols, achieving the 
same task with a much shorter key. 

For the rest of the paper, we summarize related works, review 
background material, present the details of our construction, 
after which we discuss various applications and open prob- 
lems. 

Related work 

Approximate error correction was studied in [25] to reduce 
the block length (and thus improving the rate) for a more 
specific error model. Success criterion and algebraic sufficient 
conditions were given. Reference [26] provided an infor- 
mation theoretic approximate error correction criterion. The 
approximation in these works stems from a relaxed decoding 
procedure. Much closer to our work is Ref. [27] (in the 
context of quantum secret sharing) that used a randomized 
code to maximize the distance with high probability but the 
rate is low (of lesser concern in that context). Our construction 
was inspired by that in [17] in the classical setting. Further 
comparisons between our work and these earlier results and 
insights obtained will be discussed in Section IV1 

After the initial presentation of this result [28], we learned 
of two independent studies of list codes, both in settings quite 
different from our own. Ref. [29] studied decoding of classical 
list codes with quantum algorithms, and Ref. [30] studied list 
codes for sending classical messages via iid quantum channels. 

II. Background and Definitions 

Our sender, receiver, and adversary will be named Alice, Bob, 
and Eve, respectively. The encoding of a fc-qubit state \ip) 
into a QECC will be written as We call the Pauli group 
acting on n qubits Q n and write its elements in the form 
P = i*X u Z v , where t G {0, 1, 2, 3}, u, v are binary vectors 

'it is folklore, somewhat implicit in the hashing protocol of [23]. It is also 
implied by our current construction. 



of length n, X u (Z v ) denotes X Ul ® • • • <g> X u "(Z Vl <g> • • • <g> 
Z v "), X = (° I) and Z = (J _°). The (anti)commutation 
relation between Pi , P% G Q n is determined by P\ P2 = 
(-l) w ( Pl ' P2 )P 2 Pi with w(Pi, P 2 ) = ui • v 2 + u 2 • vi, where 
the dot products and sum are computed in arithmetic modulo 
two. We let (Pi) denote the subgroup of Q n generated by a 
set of Pauli elements {Pi}. 

A state is said to be stabilized by a Pauli matrix P when 
P\ip) — An [n,k] stabilizer code is a 2 k -dimensional 
space of n-qubit states simultaneously stabilized by all ele- 
ments of a size 2 n ~ k abelian subgroup of Q n . The abelian 
subgroup is typically called S and is referred to as the code's 
stabilizer, and has n—k generators denoted by {Si}™~ k . For 
any E G Q n we refer to the (n— fc)-bit string ui(E,Si) as 
the syndrome of E [20], [31]. The weight of a Pauli matrix 
P, which we denote by wt(P), is the number of qubits on 
which P acts nontrivially, and we call a stabilizer code an 
[n, k, d] code if it can detect all errors outside of S of weight 
less than the distance d, which is equivalent to being able 
to correct all errors of weight less than [(d—l)/2\. For any 
positive real number r, let £ r be the set of Pauli matrices of 
weight no more than . Let N(S) be the set of all unitaries 
leaving S invariant under conjugation. (N(S) is the center 
and also the normalizer of S in Q n , thus the symbol N.) 
Note that two errors Ei and Ej have the same syndrome if 
and only if e\E 3 - G N(S). Thus S defines an [n, k, d) code 
exactly when every pair of errors Ei , Ej G f^" 1 )/ 2 satisfies 
E\e,j N(S) — S. Intuitively, it means that the syndrome can 
be used to identify all errors of concern up to a multiplicative 
factor that is in S and has no effect on the codespace. 

We state a property of the Pauli group that will be useful later. 
For any subgroup G of Q n , for any set S of % independent ele- 
ments in G, and a specific (ordered) list of i (anti)commutation 
relations with elements of S, exactly \G\/2~ l elements of G 
will satisfy those relations. 

Definition 1 The n-qubit adversarial quantum channel with 
error rate p, which we call , acts on a state of n qubits, 
p, and is of the form 

x$!{p) = Y; A *p A \ withA i = E a E E (d 

i EES'" 1 

subject to the requirement that A^Ai = I and where 
gnp _ |^ g J w t(E^ < p n y i s as defined before. The 
particular choice of the {Ai}'s is made by Eve only after 
Alice and Bob have decided on a communication strategy. 

Notice that to communicate effectively over one must 

find a strategy that works with high fidelity for all channels 
described by Eq. ([]]). To do this, we will use quantum list 
codes, which are defined below. 

Definition 2 We say that an [n, k] stabilizer code, C, is an 
[n,k,t, L]-list code if there is a decoding operation, T>, such 
that for every Ei G £* and \ ip) G C, the decoded k-qubit state, 
along with the syndrome s, is given by T>(Ei\'tf>)('ip\Ej) = 
Es Ej A'jWMA? ® \s)(s\ where *£ sj Af A* = I, and each 
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A? is a linear combination of the 2 L elements of (Pf)f =1 , 
where {Pf}f—i is a list of logical errors on the codespace 
and {Pi)f—i is the group they generate. 

Note that in the above definition, the set {P?}f—i generating 
the error list depends on the syndrome s. 

III. Quantum List Codes 

We now show that, asymptotically, there exist [n, k, t, L]-list 
codes with favorable parameters. We proceed by considering 
random stabilizer codes, arguing along the lines of [23], [20]. 
In particular, we will show that if we choose a random 
stabilizer code with rate as below, in the limit of large n the 
probability of it failing to be L-list decodable is less than 1. 

Theorem 3 [n, \_Rn\ , [pn\ , L]-list codes exist for sufficiently 
large n and for 

R<l-(l + jj(H(p)+plog3). (2) 

Proof: Let N E = \£P n \ and 8 pn = {E,}^. Since two 
errors E.- L and Ej have the same syndrome iff EjEj G N{S), 
a code will fail to be X-list decodable only if there are L + 1 
independent errors Eo, ■ ■ ■ , El outside of S having the same 
syndrome. Mathematically, this means e\E 3 G N(S) for < 
i,j <L (or equivalently, E^Ej G N(S) for l<j< L). The 
proof consists of two steps: (1) bounding the probability (over 
the code) for a fixed list of L independent Pauli matrices to be 
in N(S), and (2) taking the union bound over all such possible 
lists to show that list-decoding will fail with probability (over 
the code) strictly less than 1. Thus, the desired list code must 
exist. 

Step (1) is essentially a counting argument. How many ways 
can we choose n— k stabilizer generators Si, S2, • • • S n _&? 
Here we omit overall factors of ±1, i, but we count different 
generating sets (for the same code) and different orderings@ 
There are two constraints for the generating set, commu- 
tivity and independence. Si can be chosen from any of 
the 2 2 ™— 1 nontrivial Pauli matrices. Recall the property of 
Q n stated in the previous section. S2 can be chosen from 
the 2 2 "" 1 Pauli matrices commuting with Si but must be 
chosen from outside of the multiplicative group generated by 
Si, thus there are 2 2 ™ -1 — 2 choices. Similarly, each Si is 
chosen from the 2 2 ™~( l ~ 1 ) Pauli matrices commuting with 
Si, • • • , Sj_i but not from the multiplicative group generated 
by them, so there are 2 2n ~(*~ 1 ) — 2 i ~ 1 choices. Thus, there 
are n™"^" 1 (2 2 ™~ a -2 a ) distinct generating sets. 

Now, for an arbitrary and fixed list Eq, ■ ■ ■ , El of independent 
errors, how many choices of stabilizer generators will give a 
code with {eIEj} G 2V(S) Vj=l, • • • ,L1 This counting is 
similar to the above, but now Si, S2 • • • S„_fc are constrained 

2 Our analysis revolves around random stabilizer generators rather than 
random codes. As an aside, the resulting code is also randomly distributed. 
Also, any stabilizer of size 2"- k has flb^o' 1 (2"- k - b -l) different 
generating sets, so we have also found the total number of stabilizers codes 
of this size. 



to commute with {EqEj}, in addition to the two original 
constraints. In other words, Si can be chosen from the 
2 2 ™ _i — 1 nontrivial Pauli operators commuting with the 
EqEj, and S2 has 2 2 "~ i+1 — 2 choices, and so on. Thus, there 
are n™!^ 1 (2 2 "~ L ~ a -2 a ) sets of stabilizer generators that 
commute with all of E^Ej. 

Putting together with the two stabilizer counts, one un- 
constrained and the other with the same syndrome for 
{Ej}j=o,--- ,l, the latter has probability 

Y\ri — k— 1 (n2n — L — a na\ 

iL a=0 \ Z L _J_ < 2 -i(n-fe) (3) 

n";^ 1 (2 2 "- Q -2 a ) " 

For step (2), we apply the union bound for the choice 
of the L+l Ej's. The probability that a random [n,k] 
code is not L-list decodable is less than ( i ^ | f 1 )2 _i( "~ fc \ 
which is no more than N^ +1 2~ L( - n ~ k \ The latter is less 
than 1 if k < n-(l+j-)logN E . But N E = \£ pn \ = 

Y^r^o 3 r ("). F° r an y S > 0, 3ns s.t. whenever n > 
Us, log N E < n(H(p)+p log 3+5/3) so choosing k = 
n [l- (l+x) (H(p)+plog3) -25/3] finishes the proof. ■ 



IV. Coding Strategy 

Theorem [3] tells us that for any R < l—H(p)—p\og3, there 
exist [n, Rn,pn, i]-list codes for large enough n and L. For 
example, we can choose the various parameters as 5 = 1 — 
H(p) - _plog3 - R, L > |(£T(p)+log3), and n > n s in 
Thm. [3}. Note that L does not grow with n. 

We now fix such a list-code, C n ' L . This always returns a 
syndrome s, a corresponding list of errors Qj G (Pf), 
and a list-decoded state of the form Yli^il^Y^l^i =: 
AT S (\ip){ip\), where is the sender's intended logical state, 
J2i BfBf = /, and each Bf is in the span of Qj. Note that 
list-decoding removes all superposition between errors with 
different syndromes. Also, no approximation has been made 
so far. 

Now we add a few more stabilizer generators to C n,L so that 
with high probability (over the choice of the extra generators) 
the receiver can decode \ip) unambiguously. These generators 
are determined by a secret key shared by the sender and 
receiver, making them unknown to the adversary. 

It will follow from the proof of Thm. [4] below that adding 
(1/ log(4/3))(2L + log(l/e)) random generators to the code 
C" L would allow us to distinguish among the {<5^-} 2 = i 
possible errors, with probability at least 1— e. This would 
require 2n(2L+log(l/e))/log(4/3) bits of shared key. 

A much smaller key can be used if small-biased sets are 
used to choose these extra stabilizers pseudorandomly [32], 
[33]. A subset of {0, l} m , denoted A, is said to be an 77- 
biased set of length m if for each e G {0, 1}™, roughly 
half of the elements of A have odd/even parity with e, or 
mathematically, |Pr a eA (e • a = 0) — Pr agj 4 (e • a = 1)| < 77. 
There are efficient constructions of 77-biased sets of length m 
with only O(^) elements [32], [33]. 
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Let Go be the set of stabilizer generators of C n,L . We add 
K extra stabilizer generators T\,- ■■ ,Tk- When j of these 
have been added, denote the code by C™' L , with k—j encoded 
qubits and generator set Gj. (Each C™' is a subcode of 
The next generator Tj + i has to commute with all of Gj but 
not be generated by it, thus, it is an encoded operation on 
the code C"' L . Without loss of generality, it is an encoded 
Pauli operation on the encoded k—j qubits, and can be chosen 
according to a random element of an jy-biased set Aj+i of 
length 2(k—j). The following theorem shows that using this 
procedure to add K = 0(Llogl/e) stabilizers allows the 
receiver to reconstruct the encoded state with high probability. 
Using the efficient constructions of 77-biased sets of length 
m < 2n with only 0( 2 ^-) elements, our construction requires 
O ({2L + log(l/e)) log(n 2 /ry)) bits of key. 

Theorem 4 Let C n ' L be an [n, Rn, pn, L]-list code of rate R 
and let C^ L be the code obtained from C n ' L by progressively 
adding K = (1/ log(4/3))(2L + log(l/e)) stabilizers deter- 
mined by rj-biased sets Ax,--- , Ak (of decreasing length) 
as described above. By using a secret key of fewer than 
0(A"(log(^))) bits to select C% L , nR - K = n{R - o(n)) 
qubits can be sent over with fidelity at least 1 — e for 

all e < 1/2. 



Tj is chosen using an ^-biased string of encoded operations 
of the code C"^, we have Pr (M^M^i . . . Mi) < ±±2, 

which immediately implies that Pr (nf =1 Mj) < {^ 1 ) K ■ By 
a union bound over the choice of /, /', the probability of any 
pair having the same commutation relations for all j is less 
than 2 2L (^f. 

By choosing r) < 1/2, K = (1/ log(4/3))(2L + log(l/e)) we 
make this failure probability less than e so that with probability 
at least 1 — e, Q s ^ can be unambiguously identified and the state 
reconstructed. ■ 

Note that e can be made to vanish exponentially with n without 
incurring extra n-dependence on the key size. 

In Theorem [4] the extra generators can distinguish the worst 
case J\f s and no union bound over s is needed. Furthermore, 
the additional stabilizers do not depend on s. It means that 
the final construction is a single quantum error correcting 
code depending only on a small key. It also means that it is 
not necessary to first perform list-decoding before selecting 
the extra stabilizers. The combined decoding operation is 
independent of s but concludes the error based on the joint 
inputs of s and the extra syndrome bits (one possible way of 
which is to first output a list based on s). 



Proof: The [n, Rn,pn, L] -list code reduces the adver- 
sary's power to choosing some JV S (with operation elements 
in the span of {Q S f} 2 f =1 = (Pf)) and a distribution of s. 
So, if we prove that for each s, the probability (over the 
choice of Ti,--- , Tk) is less than e to fail to distinguish 
between the {Q S f} f—^, the fidelity of the decoded state with 
the original will be at least 1 — e. More specifically, fix an 
arbitrary s. It is shown in [34] that M s has a %-representation 
M s {p) = Zf,f> Xf,f'Q S fP(Q s f ,y and let 

F s = {k\3 fJ , LoiTf , Q}) - lo{T?, Q s f ,)} (4) 

be the set of key values for which the additional stabilizer 
generators fail to determine the list element. Then, letting 
\ipk)('4>k \ be the encoded logical state and X>| be the decoding 
operation given list s and key fc, our decoded state is 

lf>£(AP(|M^I)) 
fe=i 

= i E 2W s (iMv>fcD) + ^ E vi{N s mm)) 

kgF, k£F s 

= (l-Pr(F s ))|^|+Pr(F s )0 s , (5) 

where cj> s = R p l {Fg) J2keF s v l(^ s (\^k){^k\)) is the state 
conditional on the key failing to distinguish the list elements 
properly. We will now show that Pr(F,) can be made less than 
e for all lists of length 2 L by choosing K as in the theorem. 
This results in a decoding fidelity of at least 1 — e. 

Now fix /,/' and define the events Mj as {w(QJ,Tj) = 
uj(Qj,,Tj)}. Then, the probability, over the choices of 
T\ ... x, that they assign the same syndrome to Q s ^ and Qj, 
is Pr(njLi-Mj) = ]\f =1 Vi{Mj\M j _ 1 ...Mi). Since each 



V. Discussion 

We have introduced the adversarial quantum channel and 
shown that using a logarithmic length secret key one can com- 
municate over this channel with a rate of 1— H(p)— p\og3. 
This is far higher than would be naively expected from 
existing QECCs, and quite close to the best known rates for 
independent depolarizing channels of error probability p. Our 
construction involves quantum list codes, which we defined 
and showed to exist with favorable parameters. Classical list 
decoding has recently played an important role in several 
complexity theoretic results (for a review, see [35]), and we 
expect quantum list codes will be similarly useful in the 
context of quantum complexity theory. 

The scenario considered in this paper and the spirit of our 
protocols are closely related to those of [27]. Comparing their 
result with ours points to interesting open questions. Reference 
[27] constructed approximate quantum error correcting codes 
of length n capable of correcting up to (n — l)/2 errors with 
high probability (compared to at most n/4 correctable errors 
for an exact code). Thus, the fraction of errors that can be 
tolerated in [27] approaches 1/2 as ?? gets large, which is much 
higher than in our scheme. Furthermore, unlike our scheme, 
no secret key is required. Instead, randomizing parameters are 
sent as part of the message via carefully constructed secret 
sharing schemes. However, the alphabet size of the codes in 
[27] grows as a function of both the blocklength and the code's 
accuracy which severely limits the transmission rate. Also, 
when their large dimensional channel is viewed as a block 
of qubit channels, the adversary considered in [27] is much 
more restricted than ours, being limited to the corruption of 
contiguous blocks of qubits. 
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Altogether, there is a general open question on the tradeoff 
between distance, rate, and key required for a code. More 
specifically, it is an interesting question whether there are 
qubit approximate QECCs which achieve the rates of our 
codes without using a secret key, or, less ambitiously, one 
with constant size. We have also left unanswered the capacity 
of A/J~ v assisted by a negligible length secret key. It seems 
plausible that the capacity is equal to that of the depolarizing 
channel with error rate p, which would be in analogy with 
the classical result of [17]. While the capacity of for the 
depolarizing channel is an open question, one may find codes 
for Afp^ with rates matching the best known for the depo- 
larizing channel. It will also be interesting to consider other 
side resources such as a negligible amount of entanglement. 
Finally, unlike DMCs, it is unclear for adversarial channels 
whether the capacity can be improved with a small number of 
uses of noiseless quantum channels. 

As a side remark, our scheme uses the secret key as a 
randomizing parameter that is inaccessible to the adversary. 
Since the adversary must corrupt the transmitted state before 
it is received by Bob, if Bob is allowed to send a "receipt" 
of the quantum states to Alice, she can simply disclose the 
random code afterwards and no key is required. In other words, 
one bit of back communication along with logarithmic forward 
classical communication (all authenticated) can replace the key 
requirement. 

As another side remark, as the channel can be used to create 
entanglement, the key used in the communication can be 
replenished by sending a negligible number of EPR pairs 
(without affecting the communication rate). Thus the key 
requirement is only catalytic. 

Our result also finds application to a related problem — 
entanglement distillation with bounded weight errors. In this 
problem, a state is already distributed between Alice and Bob, 
so the adversary has already acted and randomizing parameters 
can be sent in public without a receipt. In [36], it was shown 
that n noisy EPR pairs with errors of weight up to pn could 
be purified to n(l — H{p) — plog3) perfect EPR pairs by a 
two-way distillation procedure. Our construction lets us distill 
high fidelity EPR pairs at the same rate with only forward 
classical communication. In fact, it was suggested in [36] that 
quantum list codes could be used to reduce the computational 
complexity of their protocols — almost exactly the approach 
taken here, though in our case with an eye towards reducing 
the communication required. The question of efficent encoding 
and decoding via list codes has not yet been resolved. 

It may also be interesting to consider how restricting the 
computational power of our adversary affects the channel's 
capacity, which is another topic we leave to future work. The 
investigation of other restrictions (such as causality of the 
adversarial channel) is also natural in certain situations and 
may lead to additional insights. 
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